2024 CVEs (page 93)
Page 93 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-52811 | High | 8.2 | 2024-11-25 | The ngtcp2 project is an effort to implement IETF QUIC protocol in C. In affected versions acks are not validated before being written to the qlog leading to a… |
CVE-2024-52529 | Medium | 5.8 | 2024-11-25 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For users with the following configuration: 1. An allow policy that… |
CVE-2024-51723 | Medium | 4.6 | 2024-11-25 | A Stored Cross-Site Scripting (XSS) vulnerability in the Management Console of BlackBerry AtHoc version 7.15 could allow an attacker to potentially execute act… |
CVE-2024-32468 | Medium | 5.4 | 2024-11-25 | Deno is a runtime for JavaScript and TypeScript written in rust. Several cross-site scripting vulnerabilities existed in the `deno_doc` crate which lead to Sel… |
CVE-2024-8272 | High | 7.8 | 2024-11-25 | The com.uaudio.bsd.helper service, responsible for handling privileged operations, fails to implement critical client validation during XPC inter-process commu… |
CVE-2024-7915 | High | 7.8 | 2024-11-25 | The application Sensei Mac Cleaner contains a local privilege escalation vulnerability, allowing an attacker to perform multiple operations as the root user. T… |
CVE-2024-52787 | Critical | 9.1 | 2024-11-25 | An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filename in an uploaded file. |
CVE-2024-45756 | High | 7.2 | 2024-11-25 | An issue was discovered in Centreon centreon-open-tickets 24.10.x before 24.10.0, 24.04.x before 24.04.2, 23.10.x before 23.10.1, 23.04.x before 23.04.3, and 2… |
CVE-2024-45755 | High | 7.2 | 2024-11-25 | An issue was discovered in Centreon centreon-dsm-server 24.10.x before 24.10.0, 24.04.x before 24.04.3, 23.10.x before 23.10.1, 23.04.x before 23.04.3, and 22… |
CVE-2024-11672 | Medium | 4.3 | 2024-11-25 | Incorrect authorization in the add permission component in Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows an authenticated maliciou… |
CVE-2024-11671 | Medium | 5.4 | 2024-11-25 | Improper authentication in SQL data source MFA validation in Devolutions Remote Desktop Manager 2024.3.17 and earlier on Windows allows an authenticated user t… |
CVE-2024-11670 | Medium | 5.4 | 2024-11-25 | Incorrect authorization in the permission validation component of Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows a malicious authen… |
CVE-2024-27134 | High | 7.0 | 2024-11-25 | Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain… |
CVE-2024-11498 | High | 7.5 | 2024-11-25 | There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder to use large amounts of stack space (up to 256mb is p… |
CVE-2024-11403 | Critical | 9.8 | 2024-11-25 | There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used by the JPEG XL enco… |
CVE-2024-11664 | High | 8.8 | 2024-11-25 | A vulnerability, which was classified as critical, has been found in eNMS up to 4.2. Affected by this issue is the function multiselect_filtering of the file e… |
CVE-2024-11663 | High | 7.3 | 2024-11-25 | A vulnerability classified as critical was found in Codezips E-Commerce Site 1.0. Affected by this vulnerability is an unknown functionality of the file search… |
CVE-2024-9666 | Medium | 4.7 | 2024-11-25 | A vulnerability was found in the Keycloak Server. The Keycloak Server is vulnerable to a denial of service (DoS) attack due to improper handling of proxy heade… |
CVE-2024-11662 | Medium | 6.3 | 2024-11-25 | A vulnerability was found in welliamcao OpsManage 3.0.1/3.0.2/3.0.3/3.0.4/3.0.5. It has been rated as critical. This issue affects the function deploy_host_var… |
CVE-2024-11661 | Medium | 4.3 | 2024-11-25 | A vulnerability was found in Codezips Free Exam Hall Seating Management System 1.0. It has been declared as problematic. This vulnerability affects unknown cod… |
CVE-2024-10492 | Low | 2.7 | 2024-11-25 | A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context… |
CVE-2024-10451 | Medium | 5.9 | 2024-11-25 | A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embe… |
CVE-2024-10270 | Medium | 6.5 | 2024-11-25 | A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (D… |
CVE-2024-6538 | Medium | 5.3 | 2024-11-25 | A flaw was found in OpenShift Console. A Server Side Request Forgery (SSRF) attack can happen if an attacker supplies all or part of a URL to the server to que… |
CVE-2024-11660 | Low | 3.5 | 2024-11-25 | A vulnerability was found in code-projects Farmacia 1.0. It has been classified as problematic. This affects an unknown part of the file usuario.php. The manip… |
CVE-2024-11659 | Medium | 4.7 | 2024-11-25 | A vulnerability was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118 and classified as critical. Affected by this issue is some unknown fun… |
CVE-2024-7056 | Low | 3.5 | 2024-11-25 | The WPForms WordPress plugin before 1.9.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform… |
CVE-2024-6393 | Medium | 4.8 | 2024-11-25 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.5 does not sanitise and escape some of its Images settings, which could allow high priv… |
CVE-2024-11658 | Medium | 4.7 | 2024-11-25 | A vulnerability has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118 and classified as critical. Affected by this vulnerability is an… |
CVE-2024-11657 | Medium | 4.7 | 2024-11-25 | A vulnerability, which was classified as critical, was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. Affected is an unknown function of… |
CVE-2024-10710 | Low | 3.5 | 2024-11-25 | The YaDisk Files WordPress plugin through 1.2.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-10709 | Medium | 6.8 | 2024-11-25 | The YaDisk Files WordPress plugin through 1.2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where… |
CVE-2024-11656 | Medium | 4.7 | 2024-11-25 | A vulnerability, which was classified as critical, has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. This issue affects some unkno… |
CVE-2024-11655 | Medium | 4.7 | 2024-11-25 | A vulnerability classified as critical was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. This vulnerability affects unknown code of the… |
CVE-2024-11654 | Medium | 4.7 | 2024-11-25 | A vulnerability classified as critical has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. This affects an unknown part of the file… |
CVE-2024-11653 | Medium | 4.7 | 2024-11-25 | A vulnerability was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. It has been rated as critical. Affected by this issue is some unknown… |
CVE-2024-11483 | Medium | 5.0 | 2024-11-25 | A vulnerability was found in the Ansible Automation Platform (AAP). This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAut… |
CVE-2024-53930 | Medium | 5.4 | 2024-11-25 | WikiDocs before 1.0.65 allows stored XSS by authenticated users via data that comes after $$\\, which is mishandled by a KaTeX parser. |
CVE-2024-11652 | Medium | 4.7 | 2024-11-25 | A vulnerability was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. It has been declared as critical. Affected by this vulnerability is a… |
CVE-2024-11651 | Medium | 4.7 | 2024-11-25 | A vulnerability was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. It has been classified as critical. Affected is an unknown function o… |
CVE-2024-11650 | Medium | 6.5 | 2024-11-25 | A vulnerability was found in Tenda i9 1.0.0.8(3828) and classified as critical. This issue affects the function websReadEvent of the file /goform/GetIPTV. The… |
CVE-2024-11649 | High | 7.3 | 2024-11-25 | A vulnerability has been found in 1000 Projects Beauty Parlour Management System 1.0 and classified as critical. This vulnerability affects unknown code of the… |
CVE-2024-11648 | High | 7.3 | 2024-11-25 | A vulnerability, which was classified as critical, was found in 1000 Projects Beauty Parlour Management System 1.0. This affects an unknown part of the file /a… |
CVE-2024-11647 | High | 7.3 | 2024-11-25 | A vulnerability, which was classified as critical, has been found in 1000 Projects Beauty Parlour Management System 1.0. Affected by this issue is some unknown… |
CVE-2024-53916 | High | 7.5 | 2024-11-25 | In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy enforcement. It does not apply the proper policy check… |
CVE-2024-11646 | High | 7.3 | 2024-11-25 | A vulnerability classified as critical was found in 1000 Projects Beauty Parlour Management System 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2024-11666 | Critical | 9.0 | 2024-11-24 | Affected devices beacon to eCharge cloud infrastructure asking if there are any command they should run. This communication is established over an insecure cha… |
CVE-2024-11665 | High | 8.8 | 2024-11-24 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in hardy-barth cph2_echarge_firmware allows OS Command Inject… |
CVE-2024-53915 | Critical | 9.8 | 2024-11-24 | An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24405. It allows remote attackers to execute arbitrary code because untr… |
CVE-2024-53914 | Critical | 9.8 | 2024-11-24 | An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24344. It allows remote attackers to execute arbitrary code because untr… |
CVE-2024-53913 | Critical | 9.8 | 2024-11-24 | An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24343. It allows remote attackers to execute arbitrary code because untr… |
CVE-2024-53912 | Critical | 9.8 | 2024-11-24 | An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24341. It allows remote attackers to execute arbitrary code because untr… |
CVE-2024-53911 | Critical | 9.8 | 2024-11-24 | An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24339. It allows remote attackers to execute arbitrary code because untr… |
CVE-2024-53910 | Critical | 9.8 | 2024-11-24 | An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24336. It allows remote attackers to execute arbitrary code because untr… |
CVE-2024-53909 | Critical | 9.8 | 2024-11-24 | An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24334. It allows remote attackers to execute arbitrary code because untr… |
CVE-2024-53901 | Medium | 5.5 | 2024-11-24 | The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unspecified other impact, when the trim() m… |
CVE-2024-53899 | High | 7.8 | 2024-11-24 | virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly wh… |
CVE-2024-11233 | Medium | 4.8 | 2024-11-24 | In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead… |
CVE-2024-11236 | Critical | 9.8 | 2024-11-24 | In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can… |
CVE-2024-11234 | Medium | 4.8 | 2024-11-24 | In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI i… |
CVE-2024-35160 | Medium | 4.3 | 2024-11-23 | IBM Watson Query on Cloud Pak for Data 1.8, 2.0, 2.1, 2.2 and IBM Db2 Big SQL on Cloud Pak for Data 7.3, 7.4, 7.5, and 7.6 could allow an authenticated user to… |
CVE-2024-11632 | High | 7.3 | 2024-11-23 | A vulnerability was found in code-projects Simple Car Rental System 1.0. It has been classified as critical. Affected is an unknown function of the file /book_… |
CVE-2024-11631 | Medium | 6.3 | 2024-11-23 | A vulnerability was found in itsourcecode Tailoring Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /e… |
CVE-2024-11231 | Medium | 6.4 | 2024-11-23 | The 우커머스 네이버페이 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mnp_purchase shortcode in all versions up to, and including… |
CVE-2024-11229 | Medium | 6.4 | 2024-11-23 | The 코드엠샵 소셜톡 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's add_plus_friends and add_plus_talk shortcodes in all versions u… |
CVE-2024-11228 | Medium | 6.4 | 2024-11-23 | The 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's pafw_instant_payment shortcode in all versi… |
CVE-2024-11034 | High | 7.3 | 2024-11-23 | The The Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation plugin for WordPress is vulnerable… |
CVE-2024-11227 | Medium | 6.4 | 2024-11-23 | The Memberlite Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's memberlite_accordion shortcode in all versions up… |
CVE-2024-11199 | Medium | 6.4 | 2024-11-23 | The Rescue Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rescue_progressbar shortcode in all versions up to, an… |
CVE-2024-10519 | Medium | 6.1 | 2024-11-23 | The Wishlist for WooCommerce: Multi Wishlists Per Customer PRO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wtab' parameter in… |
CVE-2024-9942 | Critical | 9.8 | 2024-11-23 | The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the MJ_gmgt_use… |
CVE-2024-9941 | High | 8.8 | 2024-11-23 | The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the MJ_gmgt_add_sta… |
CVE-2024-9660 | High | 8.8 | 2024-11-23 | The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the mj_smgt_load… |
CVE-2024-9659 | Critical | 9.8 | 2024-11-23 | The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the mj_smgt_user… |
CVE-2024-9511 | Critical | 9.8 | 2024-11-23 | The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to PHP Object Inj… |
CVE-2024-10803 | High | 7.5 | 2024-11-23 | The MP3 Sticky Player plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.0 via the content/downloader.php file… |
CVE-2024-9635 | Medium | 6.1 | 2024-11-23 | The Checkout with Cash App on WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_wp_http_referer' parameter in several… |
CVE-2024-11446 | Medium | 6.1 | 2024-11-23 | The Chessgame Shizzle plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'cs_nonce' parameter in all versions up to, and including, 1… |
CVE-2024-11330 | Medium | 6.1 | 2024-11-23 | The Custom CSS, JS & PHP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without approp… |
CVE-2024-11265 | Medium | 4.3 | 2024-11-23 | The Increase Maximum Upload File Size | Increase Execution Time plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including… |
CVE-2024-11188 | Medium | 6.1 | 2024-11-23 | The Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to POST-Based Refle… |
CVE-2024-11426 | Medium | 6.4 | 2024-11-23 | The AutoListicle: Automatically Update Numbered List Articles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'auto-list-num… |
CVE-2024-11408 | Medium | 6.4 | 2024-11-23 | The Slotti Ajanvaraus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slotti' shortcode in all versions up to, and includin… |
CVE-2024-11387 | Medium | 6.4 | 2024-11-23 | The Easy Liveblogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'elb_liveblog' shortcode in all versions up to, and inclu… |
CVE-2024-11361 | Medium | 6.1 | 2024-11-23 | The PDF Invoices & Packing Slips Generator for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg… |
CVE-2024-11332 | Medium | 6.4 | 2024-11-23 | The HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the p… |
CVE-2024-10880 | Medium | 6.1 | 2024-11-23 | The JobBoardWP – Job Board Listings and Submissions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remo… |
CVE-2024-10873 | High | 8.8 | 2024-11-23 | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.2 via the _load_te… |
CVE-2024-10606 | Medium | 4.3 | 2024-11-23 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca… |
CVE-2024-9223 | Medium | 4.3 | 2024-11-23 | The WPDash Notes plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wp_ajax_post_it_list_comment' func… |
CVE-2024-11463 | Medium | 6.1 | 2024-11-23 | The DeBounce Email Validator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'from', 'to', and 'key' parameters in all versions up… |
CVE-2024-11415 | High | 8.8 | 2024-11-23 | The WP-Orphanage Extended plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or… |
CVE-2024-11362 | Medium | 6.1 | 2024-11-23 | The Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net plugin for WordPress is vulnerable to Reflected Cross-Site Scrip… |
CVE-2024-10961 | Critical | 9.8 | 2024-11-23 | The Social Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.9.0. This is due to insufficient verificat… |
CVE-2024-10886 | Medium | 6.4 | 2024-11-23 | The Tribute Testimonials – WordPress Testimonial Grid/Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tribute_testim… |
CVE-2024-10874 | Medium | 6.4 | 2024-11-23 | The Quotes llama plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'quotes-llama' shortcode in all versions up to, and includi… |
CVE-2024-10869 | Medium | 6.1 | 2024-11-23 | The WordPress Brute Force Protection – Stop Brute Force Attacks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_quer… |
CVE-2024-10868 | Medium | 4.3 | 2024-11-23 | The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.1… |
CVE-2024-10813 | Medium | 5.3 | 2024-11-23 | The Product Table for WooCommerce by CodeAstrology (wooproducttable.com) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions u… |
CVE-2024-10537 | Medium | 4.3 | 2024-11-23 | The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on… |